A group of sets is provided, each including a secret and an assigned identifier. The sets are stored in a hardware device that can retrieve the secret of any of the sets using the secret's corresponding identifier. A set is stored in an application, and the application is delivered to a user who runs it on a computer coupled to the device. The application defines a session key, generates session data including the stored set's identifier and the session key encrypted with the stored set's corresponding secret, and sends the session data to the device. The device retrieves from the session data the encrypted session key and the identifier, retrieves from its storage the secret corresponding to the identifier, and uses the secret to decrypt the session key. The session key is then used as a shared key for secure communications between the hardware device and the computer.